Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Segfault due to use of destructed EmergeManager #14421

Closed
AsumFace opened this issue Feb 29, 2024 · 0 comments
Closed

Segfault due to use of destructed EmergeManager #14421

AsumFace opened this issue Feb 29, 2024 · 0 comments
Labels
Bug Issues that were confirmed to be a bug @ Server / Client / Env.

Comments

@AsumFace
Copy link

Minetest version

5.8.0 with a few unrelated custom changes
(https://dev.nobugz.eu/Minetest/minetest/~files/b14e6a6ce3db2f71939e8cb1b5c3ee090b843249)

Irrlicht device

No response

Operating system and version

Fedora 39

CPU model

AMD EPYC 7702P

GPU model

No response

Active renderer

No response

Summary

The EmergeManager may be used after it has been destructed when ServerEnvironment is being destructed and runs deactivateFarObjects within as it may attempt to emerge map in order to save static objects. This results in the segmentation fault with trace shown below.
At first glance, swapping the lines at

minetest/src/server.cpp

Lines 392 to 393 in bb7f57b

delete m_emerge;
delete m_env;

and adjusting the comment may resolve the issue.

* thread #1, name = 'minetestserver', stop reason = signal SIGSEGV: address not mapped to object
  * frame #0: 0x00000000004a48c6 minetestserver`ReflowScan::scanColumn(int, int) [inlined] std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::empty(this=0x000000000f0407a8) const at basic_string.h:1221:29
    frame #1: 0x00000000004a48c6 minetestserver`ReflowScan::scanColumn(int, int) [inlined] NodeDefManager::get(this=<unavailable>, c=126) const at nodedef.h:576:66
    frame #2: 0x00000000004a489f minetestserver`ReflowScan::scanColumn(int, int) [inlined] NodeDefManager::get(this=<unavailable>, n=<unavailable>) const at nodedef.h:587:10
    frame #3: 0x00000000004a489f minetestserver`ReflowScan::scanColumn(this=0x00007fff4cea9b40, x=0, z=0) at reflowscan.cpp:142:38
    frame #4: 0x00000000004a4060 minetestserver`ReflowScan::scan(this=0x00007fff4cea9b40, block=<unavailable>, liquid_queue=<unavailable>) at reflowscan.cpp:52:3
    frame #5: 0x0000000000466810 minetestserver`ServerMap::loadBlock(this=0x0000000001405c90, blob="\U0000001d(\xb5/\xfd", p3d=(X = -31, Y = 11, Z = 0), sector=0x00007f6c1b4ad2a0, save_after_load=false) at map.cpp:1816:12
    frame #6: 0x00000000004652a9 minetestserver`ServerMap::loadBlock(this=0x0000000001405c90, blockpos=(X = -31, Y = 11, Z = 46)) at map.cpp:0:29
    frame #7: 0x0000000000465133 minetestserver`ServerMap::emergeBlock(this=0x0000000001405c90, p=(X = -31, Y = 0, Z = 46), create_blank=true) at map.cpp:1545:21
    frame #8: 0x00000000004e406b minetestserver`ServerEnvironment::saveStaticToBlock(this=0x0000000005cd9170, blockpos=<unavailable>, store_id=0, obj=0x00007f6c3c3a3050, s_obj=0x00007fff4ceaa020, mod_reason=131072) at serverenvironment.cpp:2224:18
    frame #9: 0x00000000004e7e2c minetestserver`std::_Function_handler<bool (ServerActiveObject*, unsigned short), ServerEnvironment::deactivateFarObjects(bool)::$_0>::_M_invoke(std::_Any_data const&, ServerActiveObject*&&, unsigned short&&) at serverenvironment.cpp:2160:9
    frame #10: 0x00000000004e78c0 minetestserver`std::_Function_handler<bool (ServerActiveObject*, unsigned short), ServerEnvironment::deactivateFarObjects(bool)::$_0>::_M_invoke(std::_Any_data const&, ServerActiveObject*&&, unsigned short&&) [inlined] bool std::__invoke_impl<bool, ServerEnvironment::deactivateFarObjects(bool)::$_0&, ServerActiveObject*, unsigned short>((null)=<unavailable>, __f=<unavailable>, __args=<unavailable>, __args=<unavailable>) at invoke.h:61:14
    frame #11: 0x00000000004e78c0 minetestserver`std::_Function_handler<bool (ServerActiveObject*, unsigned short), ServerEnvironment::deactivateFarObjects(bool)::$_0>::_M_invoke(std::_Any_data const&, ServerActiveObject*&&, unsigned short&&) [inlined] std::enable_if<is_invocable_r_v<bool, ServerEnvironment::deactivateFarObjects(bool)::$_0&, ServerActiveObject*, unsigned short>, bool>::type std::__invoke_r<bool, ServerEnvironment::deactivateFarObjects(bool)::$_0&, ServerActiveObject*, unsigned short>(__fn=<unavailable>, __args=<unavailable>, __args=<unavailable>) at invoke.h:114:9
    frame #12: 0x00000000004e78c0 minetestserver`std::_Function_handler<bool (ServerActiveObject*, unsigned short), ServerEnvironment::deactivateFarObjects(bool)::$_0>::_M_invoke(__functor=<unavailable>, __args=<unavailable>, __args=<unavailable>) at std_function.h:290:9
    frame #13: 0x00000000003c6bb7 minetestserver`server::ActiveObjectMgr::clearIf(std::function<bool (ServerActiveObject*, unsigned short)> const&) [inlined] std::function<bool (ServerActiveObject*, unsigned short)>::operator()(this=0x00007fff4ceaa168, __args=0x00007f6c3c3a3050, __args=52163) const at std_function.h:591:9
    frame #14: 0x00000000003c6ba5 minetestserver`server::ActiveObjectMgr::clearIf(this=0x0000000005cd91f8, cb=0x00007fff4ceaa168) at activeobjectmgr.cpp:49:7
    frame #15: 0x00000000004db894 minetestserver`ServerEnvironment::~ServerEnvironment() [inlined] ServerEnvironment::deactivateFarObjects(this=0x0000000005cd9170, _force_delete=true) at serverenvironment.cpp:2189:15
    frame #16: 0x00000000004db86c minetestserver`ServerEnvironment::~ServerEnvironment(this=0x0000000005cd9170) at serverenvironment.cpp:515:3
    frame #17: 0x00000000004b75fc minetestserver`Server::~Server(this=0x00007fff4ceaa2c0) at server.cpp:376:2
    frame #18: 0x0000000000456aaf minetestserver`run_dedicated_server(game_params=0x00007fff4ceaf080, cmd_args=0x00007fff4ceaef88) at main.cpp:1154:3
    frame #19: 0x000000000044fd64 minetestserver`main(argc=3, argv=0x00007fff4ceaf7e8) at main.cpp:264:10
    frame #20: 0x00007f6c7b44614a libc.so.6`__libc_start_call_main + 122
    frame #21: 0x00007f6c7b44620b libc.so.6`__libc_start_main@@GLIBC_2.34 + 139
    frame #22: 0x00000000002a16c5 minetestserver`_start + 37

Note: line numbers in serverenvironment.cpp may differ from vanilla 5.8.0

Steps to reproduce

Issue occurs every few weeks, no reliable repro is known to me.

@AsumFace AsumFace added the Unconfirmed bug Bug report that has not been confirmed to exist/be reproducible label Feb 29, 2024
@sfan5 sfan5 added Bug Issues that were confirmed to be a bug and removed Unconfirmed bug Bug report that has not been confirmed to exist/be reproducible labels Feb 29, 2024
sfan5 added a commit to sfan5/minetest that referenced this issue Mar 1, 2024
sfan5 added a commit to sfan5/minetest that referenced this issue Mar 2, 2024
sfan5 added a commit to sfan5/minetest that referenced this issue Mar 3, 2024
sfan5 added a commit to sfan5/minetest that referenced this issue Mar 6, 2024
sfan5 added a commit to sfan5/minetest that referenced this issue Mar 12, 2024
sfan5 added a commit to sfan5/minetest that referenced this issue Mar 12, 2024
sfan5 added a commit to sfan5/minetest that referenced this issue Mar 14, 2024
sfan5 added a commit to sfan5/minetest that referenced this issue Mar 17, 2024
@sfan5 sfan5 closed this as completed in ef0009a Mar 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug Issues that were confirmed to be a bug @ Server / Client / Env.
Projects
None yet
Development

No branches or pull requests

3 participants